Topic 12D Flashcards
security information and event management (SIEM)
Software designed to assist with managing security data inputs and provide reporting and alerting
The core function of a SIEM tool is to collect and correlate data from network sensors and appliance/host/application logs.
Agent-based collection
this approach means installing an agent service on each host. As events occur on the host, logging data is filtered and sent tom the SIEM server.
The agent must run as a process, and could use from 50–500 MB of RAM, depending on the amount of activity and processing it does.
Different types of collection
Agent based - Installing an agent on a server
Listener/collector - hosts can be configured to push log changes to the SIEM server
Sensor - A sniffer can record network data using either the mirror port functionality of a switch or using some type of tap on the network media.
Listener/collector
hosts can be configured to push log changes to the SIEM server.
A process runs on the management server to parse and normalize each log/monitoring source.
This method is often used to collect logs from switches, routers, and firewalls, as these are unlikely to support agents
log aggregation
refers to normalizing data from different sources so that it is consistent and searchable
SIEM software features connectors or plug-ins to interpret (or parse) data from distinct types of systems and to account for differences between vendor implementations
Each agent, collector, or sensor data source will require its own parser to identify attributes and content that can be mapped to standard fields
“single pane of glass”
to consolidate the activities to a single management interface for a SIEM
SIEM correlation rule
a statement that matches certain conditions. These rules use logical expressions, such as AND and OR, and operators, such as == (matches), < (less than), > (greater than), and in (contains).
For example, a single-user login failure is not a condition that should raise an alert. Multiple in an short space of time may be a cause for concern
SIEM threat intelligence feed
This means that data points observed in the collected network data can be associated with known threat actor indicators, such as IP addresses and domain names.
When used in conjunction with a SIEM, two particular steps in alert response and remediation deserve particular attention:
Validating false positives / false negatives
Quarantine
One of the advantages of SIEM and advanced security orchestration, authorization and reporting (SOAR) solutions is to
fully or partitally automate validation and remediation.
For example, a quarantine action could be available as a mouse-click action via an integration with a firewall or endpoint protection product.
Validation is made easier by being able to correlate event data to known threat data
SIEM different types of reports
Executive reports for planning and investment activity
Manager reports guide day to day operational decision making
Compliance reports provide information for regulator
retention policy
A SIEM can enact this to allow retrospective incident and threat hunting, and can be a valuable source of forensic evidence.
It can also meet compliance requirements to hold archives of security information.
A log rotation scheme can be configured to move outdated information to archive storage.
Correlation rules assign a critical level. Examples include:
Log only—an event is produced and added to the SIEM’s database, but it is automatically classified.
Alert—the event is listed on a dashboard or incident handling system for an agent to assess
Alarm—the event is automatically classified as critical, and a priority alarm is raised. This might mean emailing an incident handler or sending a text message.
Alert tuning
Adjusting the rate and circumstances alerts are set off. Alert fatigue can weaken defenses as too many alerts come through overwhelming analysts.
You can refine detection rules and mute certain alert levels.
Redirect alert floods to a dedicated group
Deploying machine learning (ML) analysis—ML is able to rapidly analyze the sort of data sets produced by SIEM. It can be used to monitor how analysts are responding to alerts, and attempt to automatically tune the ruleset in a way that reduces false negatives without impacting true positives.
network monitor
collects data about network infrastructure appliances, such as switches, access points, routers, firewalls
used to monitor load status for CPU/memory, state tables, disk capacity, fan speeds/temperature, network link utilization/error statistics, and heartbeat to indicate availability
This data might be collected using the Simple Network Management Protocol (SNMP)
